CVE-2026-107356

HighCVSS 8.8/10Last modified Nov 12, 2026

Description

U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1073596.5Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.CVE-2026-107364.9The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in CVE-2026-1073609.6A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through CVE-2026-1073614.2The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHos CVE-2026-1073627.1The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the res CVE-2026-1073636.1In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authent CVE-2026-1073655.3A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API CVE-2026-1073668.3IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bu CVE-2026-1073696.1The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, CVE-2026-107377.5The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_fi CVE-2026-1073705.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication tra CVE-2026-1073715.4When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting I